ProgCrypto (ZK) Study Group 2025 — The Moonmath Manual to ZK-Snarks: Chapter 5 Elliptic Curves

Okay. So, yeah. Uh any questions for last week? No, sorry, not last week. Last session, uh which is two weeks ago.

No. Well, I um I'll assume that um you haven't done the homework yet. Uh sorry. Yeah. Uh basically I just do some of the question and just get push.

Um you so okay um let me just explain the task again. So last week we have gone through chapter 4. Um so um the homework was actually to implement um parts in chapter 4. Um so for example finite groups you can implement a finite group um you can make it simple right um you can just implement finite groups for let's say um prime you know prime prime numbers or you can just implement one of the finite groups for example the finite group for um natural number order five right finite group for five with an add uh with the addition operator that's one one thing right um there's also like generators um exponential map If you can um well you can you can write a function that produces um an exponential map which works um factor groups um pairings I think pairings is a little bit harder here because I don't think they really go into like how how it's done. Um I think this will be covered in in chapter five.

um hashing into groups. This is something that actually is pretty um straightforward because of all the code that's available. Um rings fields implement fields and make sure that you you can do the addition and uh and all that here. Um prime field extension uh projective planes and all. So so that's essentially the the homework itself.

Um yeah. So uh I'm I'm going to go through. Okay. So I'm going to show you what I've done. Uh and okay.

So for me personally uh what I find hardest to to implement actually is the prime extension because you basically um have to implement the concept of polomials. This is one that uh I haven't written enough. Um I think my code is not currently working. So I'm experimenting with this still right now. Um but yeah other than that I've implemented mainly on the fields operation.

So fields itself uh projective planes hashing into the field. So I've implemented that um I haven't tried implementing the try and increment yet here. Um this is interesting to implement itself but this is not not too hard because they they do give you the code for it. Um yeah I do find the par extensions being more tricky to do um because you need to have the concept of um so say poloms right. Anyways, um I'm going to show you what I've done for prime field.

So, okay. So, fields itself um actually it's um not too difficult to implement. You are mainly um mainly you want to implement. So, I'm I'm using Python here. Tell me if you can't see.

So, I'm mainly using Python here and uh as you can see um it's just a field element and um the entire idea is essentially I'm implementing this to do um general field operations. Yeah. Um yeah just so um for those that do not know Python um all this double underscore just means um it basically our implementation of actual operations in Python. I'll show you the code itself but yeah I've implemented field elements. So um addition multiplication is pretty easy.

It's just doing addition and multiplication of two two different field elements and then doing a uh modulus of it of the order. So here the order just refers to um uh refers to this right like refers to this n itself right and uh yeah subtraction um honestly also not that different um this is power so this we are we are basically just taking a power off the field also not that different it's the same um python doesn't really allow you to directly do the like the exponential so um without having like overflow error. So yeah, you you do have to know this. Um you might overflow because um you might overflow when you deal with exponential of very very high numbers um which is the case in ashing. Um but yeah just this is just division.

So division um remember we talked about fat theorem in chapter 3 um where we basically um um it's basically a way of calculating in a multiplicative group or um so like how how there's a way of calculating um the inverse um of a uh field element right so in this case yeah division requires that basically divide A divide B is just A times the inverse of B, right? Math. Um so yeah, this this equal is essentially just equivalence of two field elements, right? This you need it um when you know you want to check that hey, you know, if uh field element of field five is like if three of field five is equal to let's say eight of field five, right? It should be the same.

But yeah, that's that's the entire idea. So yeah, this is the field. Um there's also inverse. So this is just um again firmness theorem. Um I've also made a convenience function here um just to make sure that I can basically do what um what you see in the codebase itself where you can actually um how do I put this?

You can um basically acts like what Sage does, right? Sage have this function of letting you define the field and then using the field to create this is like a convenience function to do that. Um and I've written some tests for this. Um yeah, I mean you can just see how it's used, right? Um so test field creation.

Uh this is fields bigger than order. I'm just asserting some stuff. So this is just all test. But yeah, this is how you use it essentially. Um you can you can just do like addition subtraction, right?

Um this doesn't work. You shouldn't be able to add fields of different like elements from different fields, right? Um yeah, so that's what I mean uh that's what I was expecting in the homework itself. Um maybe I'll define it a little bit more clearer next time. Um but yeah, that's essentially it.

So yeah, I've written some tests. You don't need to write tests for it. Um just test it out at least. Um here I'm writing test for it because I I just want to might as well do it right properly. Um but yeah, um I still recommend and highly recommend once you go back home today.

H yeah, spend some time do it. You don't need to show me. It's was just a way of learning, right? Okay. Anyways, hashing I've only implemented a knife hash.

So, this is what's uh talked about in uh let's say hashing to groups. So, here they are basically showing you first of all the truncate where is the truncate k truncation hash. This one I didn't implement but this one is pretty easy to implement. You just truncate your your string and then um yeah that that's that's essentially it. But you know um this is first of all it's very easy to do.

You can try this but this doesn't really have collision collision resistance. Um it's very simple to do it. So I've actually implemented this. So this actually has some code in it already which is very convenient. And uh what I've done is essentially I'm hashing to the cyclic group and uh I'm just using uh sharp right.

Um this is also pretty easy to implement. You just have to understand what they are trying to do. Um I haven't done this yet but yeah it's it's quite easy to implement this for the Peterson hashes. Um of course in this case we using SH 256 with Peterson. Um yeah so it's it's not difficult uh to do that but yeah as you can see u and I've hash this is the the so to say the shadow v6 uh hash that has some problems because of um I think they they they discussed about it over here yeah there there isn't there is a relation you can very easily find a relation between um two hashes um you can find a discrete relation between HTS and HTT which means that if you have HDS and HTT using this very naive hashing method of hashing over just a single generator in this case um you can just do some calculation and find out the relation between two hash values which is not good um you don't want that u because you can use it use that information to um kind of easily help you break um not break but yeah you can you can use it to to do some stuff do some um checking stuff and try to figure out what what is actually being hashed.

um not directly you can't reverse the process but yeah um you can find out a relation and eventually um you know it helps you easier helps you to find out um the underlying hash slightly easier I mean it's not very easy I believe so at least it does help you um find out um from relation you can eventually find out I think um yeah the exact process I'm not sure but yeah if you're interested go look into it and maybe enlighten me on the next uh study group. So yeah um yeah so I've implemented that um here um yeah it's very simple it's just generated to the power of this cipher text value um I think it will be nicer if I just do this uh oh no actually it won't be because this is actually a field but this is a uh number yeah it's fine um now this this might break if my it probably won't break but yeah this might break if if this value is too too big I believe. But anyways, yeah, this is just a naive way of doing it. Um but the the safer way of doing it, it's very similar to this. It's just that we have to implement um this multiple group stuff.

Um and actually if you want to do more, so this is what I I'll continue working on. I will try to push this code uh either tomorrow or sometime later. Uh but very likely just tomorrow. I have uh I have a little bit I have some stuff to work on there. But yeah, we can also look into this which is hashing into modular arithmetic where they try to so the general problem we have here is that it's not too even um when you use just a simple hash um so they are they here they are just trying to distribute um the hashed value a little bit wider um that's the general idea for the methods here to reduce bias I believe um so Yeah.

Anyways, that's what I've done um for the projective um planes. So, I have to test here. Projective planes essentially is just trying to find remember what projective planes is. So, projective planes is essentially we add a new point of infinity and then we just make it like a sort of 3D coordinate style. It's not really 3D coordinate I suppose but um and yeah, it's also very straightforward to implement.

These are all convenience function for me to create it and you use it like this right um use it to so these are all tests you use the test if basically um they are all correctly generated so here I'm just basically trying to get all the points the possible points here uh here I'm trying to see if it uh correctly works with um the coordinates I provided it and the this is the order itself and then so on. Right? These are all just um test cases. So um I think the final lines one is just um question over here. So we I just made this into a into a test case itself.

But yeah that's what I thought. Um yeah for the so for this um you have to let um your prime field has have the ability to define polomials. Uh you can do that by just doing coefficients right you can use coefficients to represent polomials which is this um of coefficients that that that's good enough. Um but yeah that's that's what um I've done. Um I skipped group and rings because um to be fair I mean to be honest um everything if you can implement the operations that I've mentioned like hashing into into fields um extension projecting planes um essentially um they are similar things to what's in the groups and uh rings.

Yeah. So I just only implemented the fields all the operational fields and all that. Yeah. So far any questions? Um the the ones that have tried, do you have any problems um implementing it?

You know, okay. Looking forward. Um so yeah uh if you have any let's if if you haven't actually done this and you want to I mean later on you have done this and you want to like just show your progress and whatnot you can push your code to to the fork repo and then just open the PR to the repo itself and you can ask me questions there like hey you know can you take a look uh see if this implementation makes sense. Um yeah I I I'm not limiting you to do it in any language. You can do it in any language to be to be honest.

Um yeah but but the entire idea is just to to be so that we can discuss we can talk about it and uh you can kind of have like a um kind of like a record of your um well studies in your study group right yeah so yeah I've put the instructions on the ripple read me essentially yeah just open a PR open a branch uh open a PR with that branch with your name on it write your name put it in the folder with your name and then you know um submit it uh when you're done. I have a PR up. I think I just pushed it just now. Um you can take a look at it. I I'll probably change the title to to have my name on it later.

Um but yeah um essentially yeah um looking forward to it anyways. So now lefty curves um I am assuming um some of you looked through this a little bit. So, I'm going to go section by section once again and uh if you have any questions, stop me. If you don't have any questions, um go for it. Um so, we'll only be covering the first three section of chapter 5.

Uh we'll not be covering pairings today. So, yeah. Uh let's begin. Um stop me anytime, speak up. Um open your mic if you want to.

Um or just type in the group. I'll be looking right. Okay. So, first um curves um short wise wires curves questions here. A fine short wise transforms.

Stop me. Uh if I'm going too fast, stop me. It's good. Yeah, let me just open this. Sorry.

Yep. Oh, nice. Does it work with the online stage math? Uh, okay. Um, the Let's see.

Okay. So, since you've mentioned it, uh, let's let's I I'll show it on my laptop, right? Might as well. Right. Today we have less people.

Um it's a good thing. Um in a way that um now I can essentially give some special treatment. Um give me a moment. Let me just put my Okay, there we go. I hope you can see this.

Let's do this. Okay, great. Um yeah, if it's too small. Okay. So, um I I'll just do one plot um to see um that you see.

So, um let's do Sage A= F5. So, this is in a field of five. Ah, I have to define F5 equals the the group first. So, group five sorry. Okay.

A = F5 D = 54. So F56* F54* A to the power of B plus oh this is a polomial actually. Oh no actually this is the so this is essentially the the form itself the formula itself so the fine shop form is this where is it a yeah this right that's why it's being uh written here okay so I'm just going to continue this y7 seven and speed of two. I think I need to There you go. Oh.

Ah, it's fine. equals five zful which is correct. Now let's do E= elliptic curve. Ah, I spelled it wrong. And oh, sorry.

This is not the form. I think this is just discriminant of it. Yeah. So, this is the this I'm very sorry. It's just checking this.

Um, yeah. Anyways, okay. Um Q= E 02 A E do XY 02 infinity equals points on infinity which is uh let's go to XY sorry get X right here XY [Music] Yeah, zero division error in this case. Yeah, you the infinity point in does not really have a a fine coordinate which means that I mean it's used for calculation but it's not really represented as a xy point in this case. Um so yeah uh let's look at the plot shall we?

E.plot plot. Where is my plot? Where has my plot gone? That is a very interesting question.

Where has my plot gone? It should popped up, but it's not popping up. I think I probably didn't set it up correctly. Ah, unfortunate. Anyways, let me try to just pee.

Oh, yeah, I can. Yeah, there you go. Tada. I have a feeling this is a bit Oh, yeah. It's F5.

Yeah, it makes sense. Yeah. Yeah, this is correct. Yes. Um this image is like this because we are basically doing um a field of order five over um the elective curve right over the so in this case is is yeah over this um y like form um itself.

So yeah that's why and this is a elliptric curve of uh Yeah. So in this case, yeah. Yep. Four others. Yes, you're right.

Absolutely correct. So yeah, it's correct. This this Yeah. Anyways, yeah, this this is confusing because it should be just E.plot, right?

Yeah. Um if you do a little bit more, uh for example, tiny chop, it should show more. All right. If you have an bigger order, it should show more. By the way, um let's try um you know what?

Let's try this. Why not? Uh we we'll do the I clear. No, doesn't really clear correctly. Let me just clear here.

See yourself. So, let's look at um SECP 256 K1. Um, so that's the curve that um, Ethereum and Bitcoin uses. Oh, this is bad. There you go.

Yay. So, let's see. P is prime because Oh, it's not prime. I think I screwed up. Um, give me a moment.

Ah, that's why. So, this is the page number. There you go. ah e dot is prime. So I'm copying Yeah, I'm copying this street from the uh from the book itself.

That's fine. Um so yeah, he is prime. Um let's do this should also be correct ambits. Yep. So let's let's create based on this and look at the the generated graph.

Yeah. [Music] How order what's the order of this? Actually, I'm quite curious. Oh, that's a huge one. Yeah, this is um yeah, this is the basically just this number, right?

Um the order of it is essentially the size of it, which is essentially the um yeah, the the number we're based on the first place. So, let's look at the plot. Oh, function have no plot. Ah, I didn't really It's this right. lot.

This should be a lot more. See if it pops up. It's taking some time. Uh yeah, in the meantime. Okay.

So, anyways, yeah, that's that. Um I'll wait for it. As we wait for it, let's just go through the other sections. Um so, okay. Um fine sh form any questions here?

Um nope. Okay, let's go to isomorphic a fine sh curve. Okay, why is this measure equation so special and what it tells us? Okay, so we are talking about this, right? So um so this essentially um this is special or like what what it tells us um this.

So this is actually in uh our beloved um well quadratic equation I believe. Yeah. Um but anyways yeah um so what this tells us is that uh at least from my understanding of it um so so let a= equal to zero. So this tells us that this uh cubic equation um well let me let me let me collect my thoughts. I I don't want to say it incorrectly.

It's from my understanding. Um, so uh Well, let me let me collect my thoughts for a little bit. Okay. So this I believe it comes from um no AB. Okay.

So this cubic equation um let's look at this cubic equation u if this well let let's see what happens if this is equal to zero. Okay. So if this is equal to zero um essentially uh what happens is that if it's equal to zero that means that they might so that means that essentially the the A and B value right this determines or this shows um so to say um if the A and B value is selected Um well, how do I put this? Results in a curve that have um self insert intersection. Um self intersection as in it intersects with itself.

um like instead of so if you look at this this graph uh that they provided um there's no intersection of um the graph um right and and this this itself so without the inter like intersection so the intersection what it will result in is it will create a really weird um not very weird it will create a behavior where we don't really want in a um elliptic curve at least ones that well ones that doesn't benefit us when we want to do um so later on we we talk about this in our group law. So you want to do group law and um if it's not equals to zero um it means that there is some intersection of the graph to itself and when we use the group law here it will result in behavior that we do not want for elliptic curve. So yeah. So so when you choose your value for A and B in your construction of a curve using the SH various SHs form um you should use this to check um essentially if you know the value we shows it's it's suitable um to be used as a curve. Yeah ZK I believe you're right.

So yeah it's a it's a method to select well Yeah, it is a matter to select A and B. Is it a matter to check um if A and B is suitable for for your specific um curve? Yes. Any more questions? I still plotting.

I think I don't think my my graph is coming up anytime soon. I'm just going to stop it. I don't think I can stop it even. But anyways, yeah. Any more questions?

Yeah, here it does explain it. Um, there you go. Yeah, the equation ensures that curve is non-s singular which loo means the curve has no cups for self intersection the geometric sense even if seen as an actual curve. Um, yeah. So, let's continue.

Yeah, stop me anytime if you have any questions please. Um, yeah. So, isomorphic isomorphic a fine short visual curve questions compressed representation of group laws. Yeah, this is the what what curves can be described as an a fine short wire shrouds? What special property they all shed?

Um, okay, let me just go here. So, oh, uh, I believe it's probably described here. um to put it very generally um well what curves can be described? Well curves that well usually curves that um you can so curves that is essentially described via this form we call it the fine short wire sh form. So shortwire SH's curve itself um okay how how do I how do I explain a fine form?

Yeah yes the the equation itself um I mean the the equation itself is one thing. So the a fine form of short wire sh is this is this equation and it does require you to define like a a point of infinity. So this is is used for um calculating the points you do not see. Um but yeah so this okay so let's let's read this through like so the the sort of rel in is a fine representation. So it's the set of all pair that of the SSI the short cubic equation together with the screen distinguish symbol um oh right so from my understanding this is the fine form this this is a fine representation um I believe there is another form for this um yes I believe So um I I I recall uh there was this yeah I recall there's a there's another way like there's another representation of this uh so a fine we like to use a fine representation here um I believe because it's pretty easy to understand on in the geometric sense um it's very easy to understand why um like through this um equation uh like or what what it is Um I believe that's the that's why that's why we we use this for um sorry that's why we use this representation.

That's another representation. I don't recall the name. I I will need to go and look it up again. But yeah I a fine representation is this. There's another representation.

I I don't recall the name. Um yeah. Um what special property they all share? So um as for the special property uh I think short life okay so this book itself doesn't talk too much about its special property other than um it is like this um it we can use the cord and intangent rule uh which can be used for um to represent uh a fine means represent is it yeah I might have gotten uh things confused but yeah I believe we're using the fine form specifically no actually points are geometric um I'm pretty sure points are geometric um yeah but I I forgot I recall right I recall looking into this um I might be wrong yeah but but yeah I'm not quite sure but but okay I'll go back to the what so one one of the things that we want from curve from all the curves um in this case um is the ability to do the C and tangent tangent rule right um we want this because we can use this um to repres represent our group operations. Um so remember the addition and and and multiplication we have in our group.

Um so that that essentially we can use the C rule to actually represent in in the in in this um or in the actually in the curves that we're going to discuss here. Um as for so the three curves that we are talking about here right um it's very much very suitable not very I mean it's very much more suitable for um what we're going to do in in snarks. Um I'm I'm not very sure but I'm pretty sure there are other curves that um does not really fit into like in in our use case of like cryptography or whatnot but in cryptography um so what we are talking about like what we are talking like the curves that we talking here about here it's very much very suitable or like they are more suitable for cryptography when compared to um all the possible curves out there. So yeah um probably also this possible to represent in call monary and twister for um no a fine a fine representation is different from from that so a fine representation there is a fine representation for all of this um okay I mean in Edward's case we don't really talk about it like that um but yeah there is a fine representation is all in all of them there's another representation I really do don't remember um but yeah let's see uh yeah ah there is yeah sorry so the fine rep okay yeah yeah yeah I remember now so okay so yeah it actually gave me a pretty nice um uh explanation here um yeah so uh oh no it's on not this Yes, I think the another representation is called a projective representation which is essentially this right. They they represent it in this form with the point and infinity as well.

Um I might be wrong but but yeah um I believe that I I have some recollection of it. Um but yeah I'm not I'm not still not too sure but I'm pretty sure. So yeah a finite representation basically just do not concern itself with um the points and infinity like the projective planes um whereas you know if you use the projective um representation it will include that I believe I believe that's why we we talk about a fine a fine a fine form a fine representation because we I mean essentially it's just saying yeah this this um specific um function um with a point infinity that that we just we can just use right rather than we have us having this entire project plan. I believe that's why I believe that's another representation that I I was thinking about but yeah um the twisted from Mont Montgo Mary is slightly different from this. So apparently here when we talk about a fine representation it's just mainly about um how we represent this in uh like how how we actually describe this um is it's yeah okay I'm going to continue so um find group law scal multiplication logarithmic ordering M projective shop.

Why should Here here they talk about the projective form uh projective uh representation I believe it. Yep. projective group law. So this is talking about how how how the group will look in in in the projective um representation. So I mean uh it's it's going to be fine if you try to implement this.

Tell me if you did it. Um yeah this probably called group isomeorphism. Yeah. So monomeary curs. Any questions here?

fine coordinate transformation questions. Okay. Um yeah, good questions. Why do we want to use the monsole memory codes? Let me just click into that.

Okay. So, um Okay. So, um before um do Why we want to use this is that it has additional properties, right? To put it very simply, it has additional properties. So, one thing to note, um later we're also going to talk about uh twisted Edwards curve.

Um let me check if I remember incorrectly. Uh let me see. Let me see. Let me see. Let Okay.

Yeah, I'm pretty sure. Yeah. Great. Okay. So, um a mon goary curve can be so okay a yosc might be a mon goary curves.

So, so they are subset of wires curves w curves that are gary curves. So like more almost I think all monzary curves are wire sh curves that they are valid short wire sh curves but not short all short w curves are mon gary curves. So in the case of why we want to use Montgomery curves, it's essentially that they have additional property that allows us to do computation slightly better, slightly easier, slightly more efficient. Um you they they do they they represent the same um bunch of points. However, so they actually talk about here um the curve looks different if if you plot it out, right?

I'm I'm failing to plot it out. Um Sage is not responding. Uh, I think this is way too much point for it to compute. But anyways, anyways, um Oh, my laptop is just hanging. Yeah, it's dying.

Anyways, um it's canceled. Um yeah, let's quit this um monome curves essentially is is just um so let's look at this. So those curves allow for constant type algorithm for for scala multiplication in this case, right? So um you can write some of the short curve in this form. When you can write it in this form, it means that they are they are valid on commentary curves.

Uh but yeah, not all of them. So that's that's the main reason why we want to use it. Um it's slightly more efficient in this case and I'm just going to jump to twisted curve. Um so even in Montgomery um there is this problem of you still need to do group law and group law there is um some um problems not problems I mean there are branches right you have to define so so look at this right so we have to handle the neutral element the inverse element the group laws of the group law you need to handle it for each of these right they are all if statements essentially um that's where twisted advers curves come in right so Okay, so short wire shorts curve um here we talk about this um essentially um actually we talk about all of this um because they are pairing friendly right and um so all of the curves we describe here are all pairing friendly but um shortwise curve which is pairing friendly but but perhaps but but quite slow to compute mainly due to I think mainly due to the group law being hard to hard to deal with because you actually need to define each of them. Um like oh how how how do I do the cord rule and tangent rule?

Whereas monomeary curve if you look at they are they have already defined it in um formulas that is very easy to calculate as compared to the short y curve where where it's very much geometric. This is slightly easier to to do calculation with um because of its property. Um and then we'll look into twisted average curve which is even easier to calculate because we can we can basically make it so there's only one operation. So this this is actually related to the monome curve as well. So um through one operation it is very easy I mean I believe it's also like a subset of monome if I'm not wrong um but essentially this allows us to implement it in computer uh pretty easily this is very friendly for a um computer implementation right that's why that's why this that's why we we have we introduced to twisted awards curve Um of course you know so a very interesting thing is um you a very interesting homework I would suppose is you you try and um implement all of this you know uh because you know implementing I believe top two should be pretty hard yeah do benchmark so implementing these two should be pretty challenging uh I'm not sure if it's I think it's possible to implement short form like probably just difficult but like twist should be relatively easy to implement.

Um because of its property of being um I mean this essentially is saying yeah I want to make it stuck friendly. We want to reduce um as much branch as possible. Why why is that the case? Well, you will look we will actually talk about it later, but the branches are not friendly to snarks due to the fact that for each branch so it reduce the determin like it reduce not reduce it makes it not deterministic um so to say if you have branches it makes it not deterministic and and in in snarks we want to deal with deterministic stuff we want to represent um our program in uh polomials which we can can then you know operate on and having a curve that has less branches or like the operation like to to do calculation curve has no less branches makes the implanation a lot friendlier to snuck. So yeah, and and there's also this the the fact that it with less branches it uses well doesn't even use I mean I guess yeah with less branches it does make it so that you don't have to when you do calculation you don't have to like um well you can share a lot more resources in a way right the field operation should this be the lesson in this case.

Yeah, I will try to look into a little bit more into this so so we can maybe talk about it next week. Yeah, but yeah, the best way to actually know about like um like Okay, so I think probably the biggest comparison will be the monomeic curves and the twist out curves because this this essentially is a extension on the monomeic curves itself like but it's very friendly towards computer. Um yeah that's that's why we we have this tree right? We are we have all this because it's it's like that's the reason. So if you look at the twisted group law it's just this compared to this.

If we look at the group law here click it's this. So, so I mean we basically have to deal with if it's the tangent rule we need to calculate like this. If it's the cord rule we need to do it like this. Whereas in twisted curve, we only do it like this. So this single thing allows us to so this equation right um allows us to essentially do um this entire thing.

So you don't have to deal with like if this is the case we need to do this. If this is the case we need to do this. Um yeah inverse as well. You don't need to say like oh if if we have this it's this right. You can just do the calculation straightforward here.

Yeah. So yeah, that's the three curves essentially short wire shorts curve which is which is the fine form defined very simply um have all the properties you know the projective form of it we can look at the group law so group law here it's just as you can see it's a little bit more abstract because it's just drawing a line and then determine that right this but this is very easy to understand if you draw it on the paper because um there is pictures for simple and standard for all possible values. No special. Yeah, this for the for the twist. Yes.

So in this case, well, if you draw on um uh if we draw on the graph, let me let me just find a picture, right? Um I think you'll probably see if you Google lift curve, you'll probably find this picture. lifting purse. Let me just search called intention. But actually this this is this is essentially it right.

If if you see this yeah this this is called intangent room. Um but yeah um called intangent. Yeah there you go. Yeah, very easy to like to visualize this, right? Um you draw a line, you know, you pass through this and then we take the tangent of it.

Um and then you know the the other operation is just doing the same thing again and again and again and again. Uh which results in the multipoints that you see, right? Uh it will just continue continue. Uh but this is this is very easy to explain in in this um short cost curves, right? When we talk about it.

Um however you know uh when you want to do calculation I mean in algebra or like facts and wise um it's a lot easier to define like when you define it like like so right let me see where is okay I need to go down yeah there you go define it like this is a lot easier um yeah I need to close this I think just close Yeah, right. Um, this is a lot easier to calculate now even with with without the points and all that without the graph and all that, right? A lot easier to do. Um, and then you know when we go to like computer implementation, we don't branch just one thing and then we can basically use this operation and just do all the calculations right and this will work. So yeah, that's the tree curves.

Any questions? I think I think if you if you are the type of person that that really benefits from practical um work and implementation um yeah trying to implement this few is going to help you a lot. Um any questions? If not then I think we can probably call it a day today. Next week um so next week um we're going to be finally going to pairings and hashing into curves.

So actually actually the the last three things right. So um this tree so 5.4 to 5.6 um probably not into statements. Um we we'll see how fast we go.

But yeah, close pairing is is like one of the core um core ideas in um plon in gro 16 not in fry not not in like the recent u stack based VMs but they are core ideas. So yeah it'll be quite exciting to do this. Um yeah okay I really have question how to transform the two curves into twisted adverse form. um I would say well transform into it h it's very much dependent on the parameters you choose so uh in this case uh it's a and b right um in in in bas's uh curves case it's a and b i think multicary curves so a and b um I believe there I think I'm not sure if they talk about it here. Uh no, I don't think they talk about it directly here.

They do talk about multic. How do you want to actually um find just Yeah. So this is Oh, this is shorts. Uh this is com this is converting from Monto to shop, I believe. Yeah.

Um, so, um, I wouldn't say transform it over. I Okay, maybe you are. Okay. Uh I'm not sure exactly how to do that, but um you can't you you need to have a curve that is that that that can be that can be um a Montary first or like you need to have the curve to be so to say I don't think compatible is the right word. Yeah.

But essentially you need to have maybe compatible but yeah you have to have a curve that that can also have the property of this curve. Um if they are then you can transform over. How does one transfer the transform it over? Um that is a very good question. Let me find out and I'll come back to you on this actually because they they actually talk about like hey you know you know a twisted curve can go back to Montary and a monary curve can actually go back to straw wire sh like the form itself they can go back because they are subsets of each other from my understanding um just is a little bit more I'm not I'm pretty sure it's also a subset but yeah anyways um they can go back you can you can map it back um But they don't talk about how do they convert it over.

But I believe it's possible. I But you really need to know the the parameters. Um let let me just record this. Uh how to convert from [Music] Okay, let me see. asked if ALO use BLS 12 37 uses for hashes and commitments for efficiency purposes.

Um, are you saying that they don't use the twisted adwords from for other operations other than hashes and commitments? Of course, BLS itself um might I mean they might just be using the twisted adwords form for BL for BLS curve, right? Um I I'm not sure this this I'm not sure. Um but yeah, I can I mean to do share if I mean the code and whatnot and so we can all look into it. I think that that's going to be interesting.

Maybe next week we can look into it. Yeah. Um no but but like twisted adwards it's not a curve itself it's a form to represent curves right um cuz B2 377 it's just a basically well yeah I don't I'm not sure yeah I'm not sure um pretty sure I might be wrong I might be wrong here cuz yes twisted ever form supposedingly supposedly um yeah it's going to be efficient for for computation right so very likely they will just be using if they are going to use twisted ever's form for it anyways actually I I really have need to look into this um because if they are going to do computation anyways why not just use twist forms of the the curve itself for everything right um at least that's my understanding of it you know since it's um more efficient in this case, but who knows? They might want to use some other form for specific computational purpose as well. Um yeah, I'm not I'm not 100% sure on this.

I I'll actually need to look into it, but that's a very interesting thing to to to to look into actually. Yeah. Do they use other forms and then change? We can we can look into this. Yeah.

Yep. So, next week we're going to cover liaring, hashing, and constructing ellipticals. Um homework is um to try implementing these three. It's going to make you learn a lot more through hand on hands-on experience. So, do that.

Um last week's homework on on the algebra on chapter 4, I'll push it tomorrow night probably. Um, so for those that want to look at how how the code might look like and play with it, you can you can look at the repo. Um, or you can just do it yourself first, sub in the PR and then look at look at what I've written, right? That that would be great. Um, yeah.

So, I think that is all for today. We'll do uh pairings next week. Um, so this is our fourth sess fifth session. Fourth or fifth session. We have like four or five more to go.

We're going to go through statements, circuit compilers, and finally this. So we are actually going into very exciting parts of of CK proofs. So if the curves is actually very interesting my very the pairings is very interesting in my opinion because this is um this is what well uh a lot of I mean leave the curve itself is very interesting because it's what modern cryptography rely on quite quite a lot right. Yeah. So anyways, thank you very much for coming once again.

Um, I look forward to seeing each and every one of you next week and uh, if you have any questions, please tell me, please send it to the group. If you're not in the Telegram group already, you should tell me now so I can send you the link. But if you're already in, ask questions in there, you know, and everything. Thank you very much for your attention. I hope you enjoyed it.

And yeah, that's it for today. Have a great night. Bye-bye.